How do I remove native permissions for Domain Admins to Create and or Modify GPOs? (NETIQKB21883)

  • Document ID:7721883
  • Creation Date:02-Feb-2007
  • Modified Date:22-Oct-2007
    • Micro Focus Products:
      Group Policy Administrator

Resolution

goal
How do I remove native permissions for Domain Admins to Create and or Modify GPOs?

fact
NetIQ Group Policy Administrator 2.x

fact
NetIQ Group Policy Administrator 3.0

fact
NetIQ Group Policy Administrator 4.x

fact
NetIQ Group Policy Administrator 5.0

fix

The only way to remove the native permissions globally is to remove the users from the Domain Admins group.  If this is not feasible, you can remove the Domain Admins group?s ability to modify GPOs on a GPO-by-GPO basis. 

 

Refer to the following steps to remove the Domain Admins group?s ability to modify a GPO:

 

  1. Launch the NetIQ GPA GUI.
  2. Expand the domain and expand the desired GPO. 
  3. Right-click Filters and select Adjust Filters. 
  4. Select Domain Admins and uncheck Edit GPOsettings. 
  5. Click OK.

 

A Domain Admin still has the ability to go back into a GPO and edit the ACL on it, thereby giving them permissions to modify the GPO again. 

 

Note:  If you use the repository functionality of GPA, in combination with Directory & Resource Administrator (DRA) delegation, you can remove a user from Domain Admins and delegate to them the functionality they need via DRA.

 



Additional Information

Formerly known as NETIQKB21883